f3654a2f17cafc873e5444dfb2225890e367be0fe1671c0b3b55b59a619e4e70 | Triage

Analysis

max time kernel
143s
max time network
150s
platform
windows10_x64
resource
win10v20201028
submitted
13-01-2021 06:51

Sharing

Report Analysis Logs

General

Target

PurchaseOrder2021.js
Size

27KB
MD5

fa8bce6d2a200116afe9f7f2ebd8ba42
SHA1

45abfb24af5f44d42a94ae145c126800fc84e48f
SHA256

f3654a2f17cafc873e5444dfb2225890e367be0fe1671c0b3b55b59a619e4e70
SHA512

fa0e29f2d4fb4509d2362dcb9b832c4eabe760a3f875d8b253a6636c7e2dea278f0ef9ec3654e0e452c90b49b5956b2ea6991af198220491cd5ea4965d753657

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 17 IoCs

Processes:

wscript.exe

flow	pid	process
7	508	wscript.exe
10	508	wscript.exe
12	508	wscript.exe
16	508	wscript.exe
23	508	wscript.exe
24	508	wscript.exe
25	508	wscript.exe
26	508	wscript.exe
29	508	wscript.exe
30	508	wscript.exe
31	508	wscript.exe
32	508	wscript.exe
33	508	wscript.exe
34	508	wscript.exe
35	508	wscript.exe
36	508	wscript.exe
37	508	wscript.exe

Drops startup file 2 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PurchaseOrder2021.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PurchaseOrder2021.js	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\PurchaseOrder2021.js
1⤵
- Blocklisted process makes network request
- Drops startup file
PID:508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...